A-28
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
CollaborationApp
•
Set of rules score weight values
•
Set of IP addresses and address ranges, which together with the rules and alerts provide the
information needed to calculate reputation scores
•
List of IP addresses and address ranges for which traffic should always be denied
•
Network participation configuration, which allows the server to control the rate at which sensors
send telemetry date to the se rver
The sensor sends collaboration information to the Network Participation server. The sensor queries the
Global Correlation server for a list of what collaboration updates are available and from which Global
Correlation server to download the update files.
Note
The SensorApp starts before the CollaborationApp, but they initialize asynchronously. Therefore, it is
possible that the Reputation Update server may download and attempt to apply one or more global
correlation updates before the SensorApp is ready to accept the update. The update server may download
and partially process the update, but it must wait until the SensorApp is ready before it can commit the
update.
For More Information
For detailed information on global correlation and how to configure it, see Cha pter 10, “Configuring
Global Correlation.”
Update Components
The Global Correlation Update client exchanges manifests with the Global Correlation Update server. It
parses the server manifest to determine what new updates are available for download and where they
reside, and then builds a list of updates to be installed. If all updates are applied successfully, then the
Global Correlation Update client commits the applied updates for each component, notifies SensorApp
that new updates are available, and updates the client manifest to reflect the latest committed updates for
each component.
The client manifest contains the UDI of the sensor, which includes the serial number of the sensor, and
an encrypted shared secret that the server uses to verify the sensor is an authentic Cisco IPS sensor. The
server manifest contains a list of update files available for each component. For each update file in the
list, the server manifest contains data, such as the update version, type, order, location, file transfer
protocol, and so forth.
There are two types of updates files: a full update file that replaces any existing data in the database of
the component, and an incremental update that modifies the existing reputation data by adding, deleting,
or replacing information. When all update files have been applied for all components, the temporary
databases are committed by replacing the working databases.
Authentication and authorization are achieved though the secret encryption mechanism and decryption
key management. The Global Correlation Update server authenticates the sensor using the shared secret
encryption mechanism contained in the client manifest. The Global Correlation Update client authorizes
sensors using decryption key management. Sensors that have been authenticated by the Global
Correlation Update server are sent valid keys in the server manifest so that they can decrypt the update
files.